PT-2021-11617 · Geeni · Geeni Gnc-Cw013

Published 2021-01-26 · Updated 2021-02-03 · CVE-2020-28998

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Geeni GNC-CW013 doorbell version 1.8.1

Description: A remote attacker can take full control of the device with a high-privileged account due to a vulnerability in the Telnet service. This issue arises because a system account has a default and static password.

Recommendations: For Geeni GNC-CW013 doorbell version 1.8.1, consider changing the default password of the system account to prevent exploitation. As a temporary workaround, restrict access to the Telnet service until a patch is available.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-28998

Affected Products

Geeni Gnc-Cw013

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-28998 · Security Note
• https://osv.dev/vulnerability/CVE-2020-28998 · Vendor Advisory
• https://gist.github.com/tj-oconnor/e21adcf9c0539a12ad2841102928cbd5 · Note
• https://support.mygeeni.com/hc/en-us · Note